Where did you get that idea? The entire bug is about password hashing. With password auth off, that's not even attempted.

Bug > are password logins still on? they are by default

You > This particular bug works even with password authentication turned off.

No. The bug is related to password authentication. If you do not have password authentication then you are not affected.

What freaks some people out is they chose parameters where they do have password authentication but they expect to always fail. That's a bad choice, like OK you did fit a cheap manual keyhole, but you threw the keys away thinking now nobody can open that - you realise somebody with a cheap jiggler can open it right ?

> This particular bug works even with password authentication turned off.

Does it ?

Somebody here has already said "You can set PasswordAuthentication=no or update to remediate"

We don't use musl at $work anyway, so I've no means to test.